You can either use a Group Policy startup script that uses cacls to set the
permissions or use Group Policy file permissions as found under computer
configuration\Windows settings\security settings\file system. Do NOT however
implement file system settings at the domain level but instead use an OU
that contains the computer accounts you want to impact even if it is just
temporary. It is very wise to do that to make sure that domain controllers
never get any file system settings that can impact your domain especially if
done incorrectly. If you are interested in trying GP file system I suggest
that you try it on a test OU first and remember that since they are not
administrative templates that removing a GPO that applies file system
settings will not reset the permissions back to default.
Steve